| Category | Microsoft Docs article | Related commit history on GitHub | Change details |
|---|---|---|---|
| security | Attack Surface Reduction Rules Reference | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/attack-surface-reduction-rules-reference.md | Title: Attack surface reduction rules reference description: Lists details about Microsoft Defender for Endpoint (MDE) attack surface reduction (ASR) rules on a per-rule basis. -keywords: Microsoft Attack surface reduction rules, Microsoft Defender for Endpoint ASR rules, ASR rules list, ASR, asr rules, hips, host intrusion prevention system, protection rules, anti-exploit rules, antiexploit, exploit rules, infection prevention rules, Microsoft Defender for Endpoint, configure ASR rules, ASR rule description -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium audience: ITPro-+ For the easiest method to enable the standard protection rules, see: [Simplified Microsoft Defender Antivirus exclusions apply to some Microsoft Defender for Endpoint capabilities, such as some of the attack surface reduction (ASR) rules. -Following is a list of ASR rules that honor Microsoft Defender Antivirus exclusions: +The following ASR rules DO NOT honor Microsoft Defender Antivirus exclusions: | ASR rules name: | |:| The **Block abuse of exploited vulnerable signed drivers** rule doesn't block a Intune Name: `Block abuse of exploited vulnerable signed drivers` -Configuration Manager name: Not yet available - -GUID: `56a863a9-875e-4185-98a7-b882c64b5ce5` - Advanced hunting action type: - AsrVulnerableSignedDriverAudited Dependencies: Microsoft Defender Antivirus, Cloud Protection - [Attack surface reduction rules reference](attack-surface-reduction-rules-reference.md) - [Exclusions for Microsoft Defender for Endpoint and Microsoft Defender Antivirus](defender-endpoint-antivirus-exclusions.md) [!INCLUDE [Microsoft Defender for Endpoint Tech Community](../../includes/defender-mde-techcommunity.md)]+ |
| security | Automation Levels | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/automation-levels.md | Title: Automation levels in automated investigation and remediation description: Get an overview of automation levels and how they work in Microsoft Defender for Endpoint -keywords: automated, investigation, level, Microsoft Defender for Endpoint -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium Previously updated : 12/13/2022 Last updated : 07/27/2023 audience: ITPro Automated investigation and remediation (AIR) capabilities in Microsoft Defender |Automation level|Description| ||| |**Full - remediate threats automatically** <br> (also referred to as *full automation*)|With full automation, remediation actions are performed automatically on entities that are considered to be malicious. All remediation actions that are taken can be viewed in the [Action Center](auto-investigation-action-center.md) on the **History** tab. If necessary, a remediation action can be undone. <p> ***Full automation is recommended** and is selected by default for tenants with Defender for Endpoint that were created on or after August 16, 2020, with no device groups defined yet.*<p>*Full automation is set by default in Defender for Business.*|-|**Semi - require approval for all folders** <br> (also referred to as *semi-automation*)|With this level of semi-automation, approval is required for remediation actions on all files. Such pending actions can be viewed and approved in the [Action Center](auto-investigation-action-center.md), on the **Pending** tab. <p> *This level of semi-automation is selected by default for tenants that were created before August 16, 2020 with Microsoft Defender for Endpoint, with no device groups defined.*| +|**Semi - require approval for all folders** <br> (also referred to as *semi-automation*)|With this level of semi-automation, approval is required for remediation actions on all files. Such pending actions can be viewed and approved in the [Action Center](auto-investigation-action-center.md), on the **Pending** tab. Pending actions time out after 7 days. If an action times out, the behavior is the same as if the action is rejected. <p> *This level of semi-automation is selected by default for tenants that were created before August 16, 2020 with Microsoft Defender for Endpoint, with no device groups defined.*| |**Semi - require approval for core folders remediation** <br> (also a type of *semi-automation*)|With this level of semi-automation, approval is required for any remediation actions needed on files or executables that are in core folders. Core folders include operating system directories, such as the **Windows** (`\windows\*`). <p> Remediation actions can be taken automatically on files or executables that are in other (non-core) folders. <p> Pending actions for files or executables in core folders can be viewed and approved in the [Action Center](auto-investigation-action-center.md), on the **Pending** tab. <p> Actions that were taken on files or executables in other folders can be viewed in the [Action Center](auto-investigation-action-center.md), on the **History** tab.| |**Semi - require approval for non-temp folders remediation** <br> (also a type of *semi-automation*)|With this level of semi-automation, approval is required for any remediation actions needed on files or executables that aren't* in temporary folders. <p> Temporary folders can include the following examples: <ul><li>`\users\*\appdata\local\temp\*`</li><li>`\documents and settings\*\local settings\temp\*`</li><li>`\documents and settings\*\local settings\temporary\*`</li><li>`\windows\temp\*`</li><li>`\users\*\downloads\*`</li><li>`\program files\`</li><li>`\program files (x86)\*`</li><li>`\documents and settings\*\users\*`</li></ul> <p> Remediation actions can be taken automatically on files or executables that are in temporary folders. <p> Pending actions for files or executables that aren't in temporary folders can be viewed and approved in the [Action Center](auto-investigation-action-center.md), on the **Pending** tab. <p> Actions that were taken on files or executables in temporary folders can be viewed and approved in the [Action Center](auto-investigation-action-center.md), on the **History** tab.| |**No automated response** <br> (also referred to as *no automation*)|With no automation, automated investigation doesn't run on your organization's devices. As a result, no remediation actions are taken or pending as a result of automated investigation. However, other threat protection features, such as [protection from potentially unwanted applications](/windows/security/threat-protection/microsoft-defender-antivirus/detect-block-potentially-unwanted-apps-microsoft-defender-antivirus), can be in effect, depending on how your antivirus and next-generation protection features are configured. <p> ***Using the *no automation* option is not recommended**, because it reduces the security posture of your organization's devices. [Consider setting up your automation level to full automation (or at least semi-automation)](/microsoft-365/security/defender-endpoint/machine-groups).| |
| security | Cancel Machine Action | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/cancel-machine-action.md | Last updated 06/03/2021 **Applies to:** -- [Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/defender-endpoint)+- [ Microsoft Defender for Endpoint](../defender/microsoft-365-security-center-mde.md) - [Microsoft Defender for Endpoint Plan 1](/microsoft-365/security/defender-endpoint/defender-endpoint-plan-1) - [Microsoft Defender for Endpoint Plan 2](/microsoft-365/security/defender-endpoint/defender-endpoint-plan-1) |
| security | Data Storage Privacy | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/data-storage-privacy.md | Microsoft Defender for Endpoint shares data, including customer data, among the - Microsoft Sentinel - Microsoft Tunnel for Mobile Application Management - Android-- Microsoft Defender for Cloud +- Microsoft Defender for Cloud +- Microsoft Defender for Identity ## Is my data isolated from other customer data? |
| security | Defender Endpoint Antivirus Exclusions | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/defender-endpoint-antivirus-exclusions.md | When you're dealing with false positives, or known entities that are generating | Scenario | Steps to consider | |:|:-|-| [False positive](defender-endpoint-false-positives-negatives.md): An entity, such as a file or a process, was detected and identified as malicious, even though the entity isn't a threat. | 1. [Review and classify alerts](defender-endpoint-false-positives-negatives.md#part-1-review-and-classify-alerts) that were generated as a result of the detected entity. <br/>2. [Suppress an alert](defender-endpoint-false-positives-negatives.md#suppress-an-alert) for a known entity. <br/>3. [Review remediation actions](defender-endpoint-false-positives-negatives.md#part-2-review-remediation-actions) that were taken for the detected entity. <br/>4. [Submit the false positive to Microsoft](/microsoft-365/security/intelligence/submission-guide.md) for analysis. <br/>5. [Define an exclusion](defender-endpoint-false-positives-negatives.md#part-3-review-or-define-exclusions) for the entity (only if necessary). | +| [False positive](defender-endpoint-false-positives-negatives.md): An entity, such as a file or a process, was detected and identified as malicious, even though the entity isn't a threat. | 1. [Review and classify alerts](defender-endpoint-false-positives-negatives.md#part-1-review-and-classify-alerts) that were generated as a result of the detected entity. <br/>2. [Suppress an alert](defender-endpoint-false-positives-negatives.md#suppress-an-alert) for a known entity. <br/>3. [Review remediation actions](defender-endpoint-false-positives-negatives.md#part-2-review-remediation-actions) that were taken for the detected entity. <br/>4. [Submit the false positive to Microsoft](../intelligence/submission-guide.md) for analysis. <br/>5. [Define an exclusion](defender-endpoint-false-positives-negatives.md#part-3-review-or-define-exclusions) for the entity (only if necessary). | | [Performance issues](troubleshoot-performance-issues.md) such as one of the following issues:<br/>- A system is having high CPU usage or other performance issues.<br/>- A system is having memory leak issues.<br/>- An app is slow to load on devices.<br/>- An app is slow to open a file on devices. | 1. [Collect diagnostic data](collect-diagnostic-data.md) for Microsoft Defender Antivirus.<br/>2. If you're using a non-Microsoft antivirus solution, [check with the vendor for any needed exclusions](troubleshoot-performance-issues.md#check-with-vendor-for-antivirus-exclusions).<br/>3. [Analyze the Microsoft Protection Log](troubleshoot-performance-issues.md#analyze-the-microsoft-protection-log) to see the estimated performance impact.<br/>4. [Define an exclusion for Microsoft Defender Antivirus](configure-exclusions-microsoft-defender-antivirus.md) (if necessary).<br/>5. [Create an indicator for Defender for Endpoint](manage-indicators.md) (only if necessary). | | [Compatibility issues](microsoft-defender-antivirus-compatibility.md) with non-Microsoft antivirus products. <br/>Example: Defender for Endpoint relies on security intelligence updates for devices, whether they're running Microsoft Defender Antivirus or a non-Microsoft antivirus solution. | 1. If you're using a non-Microsoft antivirus product as your primary antivirus/antimalware solution, [set Microsoft Defender Antivirus to passive mode](microsoft-defender-antivirus-compatibility.md#requirements-for-microsoft-defender-antivirus-to-run-in-passive-mode).<br/>2. If you're switching from a non-Microsoft antivirus/antimalware solution to Defender for Endpoint, see [Make the switch to Defender for Endpoint](switch-to-mde-overview.md). This guidance includes:<br/>- [Exclusions you might need to define for the non-Microsoft antivirus/antimalware solution](switch-to-mde-phase-2.md#step-3-add-microsoft-defender-for-endpoint-to-the-exclusion-list-for-your-existing-solution);<br/>- [Exclusions you might need to define for Microsoft Defender Antivirus](switch-to-mde-phase-2.md#step-4-add-your-existing-solution-to-the-exclusion-list-for-microsoft-defender-antivirus); and <br/>- [Troubleshooting information](switch-to-mde-troubleshooting.md) (just in case something goes wrong while migrating). | |
| security | Export Firmware Hardware Assessment | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/export-firmware-hardware-assessment.md | Delegated (work or school account)|Software.Read|'Read Threat and Vulnerability ### 1.3 URL + ```http-GET api/machines/HardwareFirmwareInventoryProductCodeByMachine +GET api/machines/HardwareFirmwareInventoryByMachine ``` ### 1.4 Parameters GET api/machines/HardwareFirmwareInventoryProductCodeByMachine - pageSize (default = 50,000): Number of results in response. - $top: Number of results to return (doesn't return @odata.nextLink and so doesn't pull all the data). - ### 1.5 Properties (JSON response) > [!NOTE] deviceId|String|Unique identifier for the device in the service. ### 1.6.1 Request example + ```http-GET https://api.security.microsoft.com/api/machines/HardwareFirmwareInventoryProductCodeByMachine +GET https://api.security.microsoft.com/api/machines/HardwareFirmwareInventoryByMachine ``` ### 1.6.2 Response example Property (ID)|Data type|Description |GeneratedTime|DateTime|The time the export was generated. + ## 2.6 Example ### 2.6.1 Request example GET https://api.security.microsoft.com/api/machines/HardwareFirmwareInventoryExp } ```+ |
| security | Ios Configure Features | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/ios-configure-features.md | Defender for Endpoint on iOS enables admins to configure custom indicators on iO Reducing cyber risk requires comprehensive risk-based vulnerability management to identify, assess, remediate, and track all your biggest vulnerabilities across your most critical assets, all in a single solution. Visit this [page](next-gen-threat-and-vuln-mgt.md) to learn more about Microsoft Defender Vulnerability Management in Microsoft Defender for Endpoint. -Defender for Endpoint on iOS supports vulnerability assessments of apps only for enrolled (MDM) devices. Admins can use the following steps to configure the vulnerability assessment of apps. +Defender for Endpoint on iOS supports vulnerability assessments of OS and apps. Vulnerability assessment of iOS versions is available for both enrolled (MDM) and unenrolled (MAM) devices. Vulnerability assessment of apps is only for enrolled (MDM) devices. Admins can use the following steps to configure the vulnerability assessment of apps. ### On a Supervised Device Use the following steps to configure the option to send feedback data to Microso 1. Select **Microsoft Defender for Endpoint** as the target app. -1. On the Settings page, select **Use configuration designer** and add **DefenderSendFeedback** as the key and value type as **Boolean**. +1. On the Settings page, select **Use configuration designer** and add **DefenderFeedbackData** as the key and value type as **Boolean**. - To remove the ability of end-users to provide feedback, set the value as `false` and assign this policy to users. By default, this value is set to `true`. For US Government customers, the default value is set to 'false'. |
| security | Ios Install | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/ios-install.md | This topic describes deploying Defender for Endpoint on iOS on Microsoft Intune - Ensure iOS enrollment is done for your users. Users need to have a Defender for Endpoint license assigned in order to use Defender for Endpoint on iOS. Refer to [Assign licenses to users](/azure/active-directory/users-groups-roles/licensing-groups-assign) for instructions on how to assign licenses. +- Ensure the end users have company portal app installed, signed in and enrollment completed. + > [!NOTE] > Microsoft Defender for Endpoint on iOS is available in the [Apple App Store](https://aka.ms/mdatpiosappstore). Configure the supervised mode for Defender for Endpoint app through an App confi 1. In the next screen, select **Use configuration designer** as the format. Specify the following properties: - Configuration Key: `issupervised` - Value type: String- - Configuration Value: `{{issupervised}}` + - Configuration Value: `true` :::image type="content" source="images/ios-deploy-6.png" alt-text="Image of Microsoft Intune admin center6." lightbox="images/ios-deploy-6.png"::: Configure the supervised mode for Defender for Endpoint app through an App confi > [!NOTE] > For devices that run iOS/iPadOS (in Supervised Mode), there is custom **.mobileconfig** profile, called the **ControlFilter** profile available. This profile enables Web Protection **without setting up the local loopback VPN on the device**. This gives end-users a seamless experience while still being protected from phishing and other web-based attacks.+> +> However, the **ControlFilter** profile does not work with Always-On VPN (AOVPN) due to platform restrictions. Admins deploy any one of the given profiles. |
| security | Linux Support Ebpf | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/linux-support-ebpf.md | The eBPF sensor for Microsoft Defender for Endpoint on Linux is supported on the | SLES | 15 | 5.3.18-18.47 | | RHEL | 7.6 | 3.10.0-957 | | Debian | 9.0 | 4.19.0 |-| Oracle Linux | 8.0 | 4.18.0 | +| Oracle Linux RHCK | 7.9 | 3.10.0-1160 | +| Oracle Linux UEK | 7.9 | 5.4 | When the eBPF sensor is enabled on an endpoint, Defender for Endpoint on Linux updates supplementary_events_subsystem to ebpf. The following two sets of data help analyze potential issues and determine the m - [Troubleshoot performance issues for Microsoft Defender for Endpoint on Linux](linux-support-perf.md) - [Microsoft Defender for Endpoint on Linux resources](linux-resources.md#collect-diagnostic-information)+ |
| security | Respond File Alerts | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/respond-file-alerts.md | The **Download file** button can have the following states: Non-Portable Executable file (.txt, .docx, and others) - Global admin or Advanced live response- - Tenants with [role-based access (RBAC) permissions](/microsoft-365/security/defender/manage-rbac.md) enabled + - Tenants with [role-based access (RBAC) permissions](../defender/manage-rbac.md) enabled :::image type="content" source="images/atp-download-file-action.png" alt-text="The download file action" lightbox="images/atp-download-file-action.png"::: |
| security | Run Analyzer Macos Linux | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/run-analyzer-macos-linux.md | If using a terminal download using the command: wget --quiet -O XMDEClientAnalyzerBinary.zip https://aka.ms/XMDEClientAnalyzerBinary ``` -2. Verify the download +2. Verify the download. > [!NOTE]- > The current SHA256 hash of 'XMDEClientAnalyzerBinary.zip' that is downloaded from the above link is: '4CCCDC7D5ABA67D576D8B1DB8C8286AAD8F09668B6DAE46968ECB297B8424042' + > The current SHA256 hash of 'XMDEClientAnalyzerBinary.zip' that is downloaded from the above link is: 'E8D1B752A937E9AB305AE3C30737E31D75AE6FF9299002AB23F5C463C77DD159' ```console- echo '4CCCDC7D5ABA67D576D8B1DB8C8286AAD8F09668B6DAE46968ECB297B8424042 XMDEClientAnalyzerBinary.zip' | sha256sum -c + echo 'E8D1B752A937E9AB305AE3C30737E31D75AE6FF9299002AB23F5C463C77DD159 XMDEClientAnalyzerBinary.zip' | sha256sum -c ``` 3. Extract the contents of <i>XMDEClientAnalyzerBinary.zip</i> on the machine. If using a terminal download using the command: 5. Three new zip files will be produced: 1. **SupportToolLinuxBinary.zip** : For all Linux devices- 2. **SupportToolmacOSBinary.zip** : For Intel based Mac devices - 3. **SupportToolmacOS-armBinary.zip** : For Arm based Mac devices + 2. **SupportToolmacOSBinary.zip** : For Intel-based Mac devices + 3. **SupportToolmacOS-armBinary.zip** : For Arm-based Mac devices 6. Unzip one of the above 3 zip files based on the machine you need to investigate.\ When using a terminal, unzip the file using one of the following commands based on machine type: - Linux - ```console - unzip -q SupportToolLinuxBinary.zip - ``` + ```console + unzip -q SupportToolLinuxBinary.zip + ``` - - Intel based Mac + - Intel-based Mac - ```console - unzip -q SupportToolmacOSBinary.zip - ``` + ```console + unzip -q SupportToolmacOSBinary.zip + ``` - - For Arm based Mac devices + - For Arm-based Mac devices - ```console - unzip -q SupportToolmacOS-armBinary.zip - ``` + ```console + unzip -q SupportToolmacOS-armBinary.zip + ``` 7. Run the tool as <i>root</i> to generate diagnostic package: When using a terminal, unzip the file using one of the following commands based > > - The analyzer depends on few extra PIP packages (sh, distro, lxml, pandas) which are installed in the OS when in root to produce the result output. If not installed, the analyzer will try to fetch it from the [official repository for Python packages](https://pypi.org/search/?q=lxml). >-> >[!WARNING] -> >Running the Python-based client analyzer requires the installation of PIP packages which may cause some issues in your environment. To avoid issues from occurring, it is recommended that you install the packages into a user PIP environment. +> >[!WARNING] +> >Running the Python-based client analyzer requires the installation of PIP packages which may cause some issues in your environment. To avoid issues from occurring, it is recommended that you install the packages into a user PIP environment. > > - In addition, the tool currently requires Python version 3 or later to be installed. > When using a terminal, unzip the file using one of the following commands based 2. Verify the download ```console- echo '4C1E100E41D0E9C0FFDA11BD7FC373C7F16E082440BA78EE0DBDD757C3C4C10C XMDEClientAnalyzer.zip' | sha256sum -c + echo '24241D30F4A19F982B83295BEF005184C0AB04F6BA1B709F0C111AADA25239C5 XMDEClientAnalyzer.zip' | sha256sum -c ``` 3. Extract the contents of XMDEClientAnalyzer.zip on the machine.\ Usage example: `sudo ./MDESupportTool -d` #### Collect performance info -Collect extensive machine performance tracing for analysis of a performance scenario that can be reproduced on demand +Collect extensive machine performance tracing for analysis of a performance scenario that can be reproduced on demand. ```console -h, --help show this help message and exit Use OS tracing facilities to record Defender for Endpoint performance traces. On running this command for the first time, it will install a Profile configuration. -Follow this to approve profile installation: [Apple Support Guide](https://support.apple.com/guide/mac-help/mh35561/mac#:~:text=Choose%20Apple%20menu%20%3E%20System%20Settings,%2C%20double%2Dclick%20the%20profile.) +Follow this to approve profile installation: [Apple Support Guide](https://support.apple.com/guide/mac-help/configuration-profiles-standardize-settings-mh35561/mac#:~:text=Install%20a%20configuration%20profile%20you%E2%80%99ve%20received). Usage example `./mde_support_tool.sh trace --length 5` Usage example `./mde_support_tool.sh trace --length 5` Add exclusions for audit-d monitoring. > [!NOTE]-> This functionality exists for Linux only +> This functionality exists for Linux only. ```console -h, --help show this help message and exit Add exclusions for audit-d monitoring. exclude all process of the given syscall ``` -Usage example `sudo ./MDESupportTool exclude -d /var/foo/bar` +Usage example: `sudo ./MDESupportTool exclude -d /var/foo/bar` ### AuditD Rate Limiter Syntax that can be used to limit the number of events being reported by the audi -e <true/false>, --enable <true/false> enable/disable the rate limit with default values ``` -Usage example `sudo ./mde_support_tool.sh ratelimit -e true` +Usage example: `sudo ./mde_support_tool.sh ratelimit -e true` > [!NOTE] > This functionality should be carefully used as limits the number of events being reported by the auditd subsystem as a whole. This could reduces the number of events for other subscribers as well. This option enables you to skip the faulty rules added in the auditd rules file > [!NOTE] > This functionality is only available on Linux. -```console - ```console -h, --help show this help message and exit -e <true/false>, --enable <true/false> enable/disable the option to skip the faulty rules. In case no argumanet is passed, the option will be true by default. ``` -Usage example `sudo ./mde_support_tool.sh skipfaultyrules -e true` +Usage example: `sudo ./mde_support_tool.sh skipfaultyrules -e true` > [!NOTE] > This functionality will be skipping the faulty rules. The faulty rule then needs to be further identified and fixed. Usage example `sudo ./mde_support_tool.sh skipfaultyrules -e true` - mde_diagnostic.zip - Description: Same diagnostic output that gets generated when running *mdatp diagnostic create* on either [macOS](mac-resources.md#collecting-diagnostic-information) or [Linux](linux-resources.md#collect-diagnostic-information) + Description: Same diagnostic output that gets generated when running *mdatp diagnostic create* on either [macOS](mac-resources.md#collecting-diagnostic-information) or [Linux](linux-resources.md#collect-diagnostic-information). - mde.xml |
| security | Defender Vulnerability Management Capabilities | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-vulnerability-management/defender-vulnerability-management-capabilities.md | The table below shows the availability of Defender Vulnerability Management capa For Microsoft Defender for Cloud customers, Defender Vulnerability Management is natively integrated within Defender for Cloud to perform vulnerability assessments for cloud based virtual machines and recommendations will automatically populate in the Defender for Cloud portal. -Microsoft Defender for Servers Plan 2 includes access to the premium vulnerability management capabilities that are part of the Defender Vulnerability Management add-on. The capabilities are only available through the [Microsoft Defender 365 portal](https://security.microsoft.com/homepage). +Defender Vulnerability Management premium capabilities are available to server devices with Microsoft Defender for Servers Plan 2. > [!NOTE]-> Premium Defender Vulnerability Management capabilities are currently enabled for all client devices across Defender for Cloud tenants with Defender for Servers Plan 2 subscription. +> Client devices will require the Defender Vulnerability Management add-on license to access Defender Vulnerability Management premium capabilities. >-> From March 15, 2023, we will begin to gradually roll out an update where premium vulnerability management capabilities will no longer be automatically enabled across tenants and will only be available for client devices eligible for the Defender Vulnerability Management add-on. -> ->To start or continue using the premium vulnerability management capabilities for your client devices, see [Try Defender Vulnerability Management Add-on trial for Defender for Endpoint Plan 2 customers](/microsoft-365/security/defender-vulnerability-management/get-defender-vulnerability-management#try-defender-vulnerability-management-add-on-trial-for-defender-for-endpoint-plan-2-customers). +> To use the premium vulnerability management capabilities for your client devices, see [Try Defender Vulnerability Management Add-on trial for Defender for Endpoint Plan 2 customers](/microsoft-365/security/defender-vulnerability-management/get-defender-vulnerability-management#try-defender-vulnerability-management-add-on-trial-for-defender-for-endpoint-plan-2-customers). ++The capabilities are only available through the [Microsoft Defender 365 portal](https://security.microsoft.com/homepage). The table below shows the availability of Defender Vulnerability Management capabilities across the Defender for Servers plans. The table below shows the availability of Defender Vulnerability Management capa |[Software inventory](tvm-software-inventory.md)|Γ£ö|Γ£ö| |[Software usages insights](tvm-usage-insights.md)|Γ£ö|Γ£ö| |[Security baselines assessment](tvm-security-baselines.md)|-|Γ£ö|-|[Block vulnerable applications](tvm-block-vuln-apps.md)|-|-*| +|[Block vulnerable applications](tvm-block-vuln-apps.md)|-|Γ£ö| |[Browser extensions assessment](tvm-browser-extensions.md)|-|Γ£ö| |[Digital certificate assessment](tvm-certificate-inventory.md)|-|Γ£ö| |[Network share analysis](tvm-network-share-assessment.md)|-|Γ£ö| |[Hardware and firmware assessment](tvm-hardware-and-firmware.md)|-|Γ£ö| |[Authenticated scan for Windows](windows-authenticated-scan.md)|-|Γ£ö| -*_Block vulnerable applications is not currently available for Microsoft Defender for Servers Plan 2. This feature is available for client devices that are eligible for the Defender Vulnerability Management add-on._ - ## Next steps - [Get Microsoft Defender Vulnerability Management](get-defender-vulnerability-management.md) |
| security | Playbook Responding Ransomware M365 Defender | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/playbook-responding-ransomware-m365-defender.md | Use this section to investigate the attack and plan your response. ### Identify the ransomware process -* Using [advanced hunting](/microsoft-365/security/defender/advanced-hunting-overview.md), search for the identified process in the process creation events on other devices. +* Using [advanced hunting](advanced-hunting-overview.md), search for the identified process in the process creation events on other devices. ### Look for exposed credentials in the infected devices |
| security | Anti Phishing Policies About | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/anti-phishing-policies-about.md | The relationship between spoof intelligence and whether sender DMARC policies ar | |Honor DMARC policy On|Honor DMARC policy Off| |||| |**Spoof intelligence On**|Separate actions for implicit and explicit email authentication failures: <ul><li>Implicit failures use the **If the message is detected as spoof by spoof intelligence** action the anti-phishing policy.</li><li>Explicit failures for `p=quarantine` and `p=reject` DMARC policies use the **If the message is detected as spoof and DMARC policy is set as p=quarantine** and **If the message is detected as spoof and DMARC policy is set as p=reject** actions in the anti-phishing policy.</li></ul>|The **If the message is detected as spoof by spoof intelligence** action in the anti-phishing policy is used for both implicit and explicit email authentication failures. In other words, explicit email authentication failures ignore `p=quarantine` and `p=reject` in the DMARC policy.|-|**Spoof intelligence Off**|Implicit email authentication checks aren't used. Explicit email authentication failures for `p=quarantine` and `p=reject` DMARC policies use the **If the message is detected as spoof and DMARC policy is set as p=quarantine** and **If the message is detected as spoof and DMARC policy is set as p=reject** actions in anti-phishing policies.|Implicit email authentication checks aren't used. Explicit email authentication failures for `p=quarantine` DMARC policies are quarantined, and failures for `p=reject` DMARC policies are rejected.| +|**Spoof intelligence Off**|Implicit email authentication checks aren't used. Explicit email authentication failures for `p=quarantine` and `p=reject` DMARC policies use the **If the message is detected as spoof and DMARC policy is set as p=quarantine** and **If the message is detected as spoof and DMARC policy is set as p=reject** actions in anti-phishing policies.|Implicit email authentication checks aren't used. Explicit email authentication failures for `p=quarantine` DMARC policies are quarantined, and failures for `p=reject` DMARC policies are quarantined.| ++> [!NOTE] +> If the MX record for the domain points to a third-party service or device that sits in front of Microsoft 365, the **Honor DMARC policy** setting is applied only if [Enhanced Filtering for Connectors](/Exchange/mail-flow-best-practices/use-connectors-to-configure-mail-flow/enhanced-filtering-for-connectors) is enabled for the connector that receives inbound messages. ### Unauthenticated sender indicators Impersonation safety tips appear to users when messages are identified as impers > This sender might be impersonating a domain that's associated with your organization. -- **Show user impersonation unusual characters safety tip**: The From address contains unusual character sets (for example, mathematical symbols and text or a mix of uppercase and lowercase letters) in an sender specified in [user impersonation protection](#user-impersonation-protection). Available only if **Enable users to protect** is turned on and configured.+- **Show user impersonation unusual characters safety tip**: The From address contains unusual character sets (for example, mathematical symbols and text or a mix of uppercase and lowercase letters) in a sender specified in [user impersonation protection](#user-impersonation-protection). Available only if **Enable users to protect** is turned on and configured. > [!NOTE] > Safety tips are not stamped in the following messages: |
| security | Anti Spam Policies Configure | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/anti-spam-policies-configure.md | You can configure anti-spam policies in the Microsoft 365 Defender portal or in |Action|Spam|High<br>confidence<br>spam|Phishing|High<br>confidence<br>phishing|Bulk| ||::|::|::|::|::|- |**Move message to Junk Email folder**: The message is delivered to the mailbox and moved to the Junk Email folder.¹ ⁴|✔<sup>\*</sup>|✔<sup>\*</sup>|✔||✔<sup>\*</sup>| - |**Add X-header**: Adds an X-header to the message header and delivers the message to the mailbox. <br/><br/> You enter the X-header field name (not the value) later in the **Add this X-header text** box. <br/><br/> For **Spam** and **High confidence spam** verdicts, the message is moved to the Junk Email folder.¹ ²|✔|✔|✔||✔| - |**Prepend subject line with text**: Adds text to the beginning of the message's subject line. The message is delivered to the mailbox and moved to the Junk email folder.¹ ² <br/><br/> You enter the text later in the **Prefix subject line with this text** box.|✔|✔|✔||✔| + |**Move message to Junk Email folder**: The message is delivered to the mailbox and moved to the Junk Email folder.¹|✔<sup>\*</sup>|✔<sup>\*</sup>|✔|²|✔<sup>\*</sup>| + |**Add X-header**: Adds an X-header to the message header and delivers the message to the mailbox. <br/><br/> You enter the X-header field name (not the value) later in the **Add this X-header text** box. <br/><br/> For **Spam** and **High confidence spam** verdicts, the message is moved to the Junk Email folder.¹ ³|✔|✔|✔||✔| + |**Prepend subject line with text**: Adds text to the beginning of the message's subject line. The message is delivered to the mailbox and moved to the Junk email folder.¹ ³ <br/><br/> You enter the text later in the **Prefix subject line with this text** box.|✔|✔|✔||✔| |**Redirect message to email address**: Sends the message to other recipients instead of the intended recipients. <br/><br/> You specify the recipients later in the **Redirect to this email address** box.|✔|✔|✔|✔|✔| |**Delete message**: Silently deletes the entire message, including all attachments.|✔|✔|✔||✔|- |**Quarantine message**: Sends the message to quarantine instead of the intended recipients. <br/><br/> You select or use the default _quarantine policy_ for the spam filtering verdict in the **Select quarantine policy** box that appears.³ ⁵ Quarantine policies define what users are able to do to quarantined messages, and whether users receive quarantine notifications. For more information, see [Anatomy of a quarantine policy](quarantine-policies.md#anatomy-of-a-quarantine-policy). <br/><br/> You specify how long the messages are held in quarantine in the **Retain spam in quarantine for this many days** box.|✔|✔|✔<sup>\*</sup>|✔<sup>\*</sup>|✔| + |**Quarantine message**: Sends the message to quarantine instead of the intended recipients. <br/><br/> You select or use the default _quarantine policy_ for the spam filtering verdict in the **Select quarantine policy** box that appears.⁴ Quarantine policies define what users are able to do to quarantined messages, and whether users receive quarantine notifications. For more information, see [Anatomy of a quarantine policy](quarantine-policies.md#anatomy-of-a-quarantine-policy). <br/><br/> You specify how long the messages are held in quarantine in the **Retain spam in quarantine for this many days** box.|✔|✔|✔<sup>\*</sup>|✔<sup>\*</sup> ⁵|✔| |**No action**|||||✔| ¹ EOP uses its own mail flow delivery agent to route messages to the Junk Email folder instead of using the junk email rule in the mailbox. The _Enabled_ parameter on the **Set-MailboxJunkEmailConfiguration** cmdlet no longer has any effect on mail flow. For more information, see [Configure junk email settings on Exchange Online mailboxes](configure-junk-email-settings-on-exo-mailboxes.md). - In hybrid environments where EOP protects on-premises Exchange mailboxes, you need to configure mail flow rules (also known as transport rules) in on-premises Exchange. These mail flow rules translate the EOP spam filtering verdict so the junk email rule in the mailbox can move the message to the Junk Email folder. For details, see [Configure EOP to deliver spam to the Junk Email folder in hybrid environments](/exchange/standalone-eop/configure-eop-spam-protection-hybrid). + In hybrid environments where EOP protects on-premises Exchange mailboxes, you need to configure mail flow rules (also known as transport rules) in on-premises Exchange to translate the EOP spam filtering verdict. For details, see [Configure EOP to deliver spam to the Junk Email folder in hybrid environments](/exchange/standalone-eop/configure-eop-spam-protection-hybrid). - ² You can this use value as a condition in mail flow rules to filter or route the message. + ² For **High confidence phishing**, the **Move message to Junk Email folder** action is effectively deprecated. Although you might be able to select the **Move message to Junk Email folder** action, high confidence phishing messages are always quarantined (equivalent to selecting **Quarantine message**). - ³ If the spam filtering verdict quarantines messages by default (**Quarantine message** is already selected when you get to the page), the default quarantine policy name is shown in the **Select quarantine policy** box. If you _change_ the action of a spam filtering verdict to **Quarantine message**, the **Select quarantine policy** box is blank by default. A blank value means the default quarantine policy for that verdict is used. When you later view or edit the anti-spam policy settings, the quarantine policy name is shown. For more information about the quarantine policies that are used by default for spam filter verdicts, see [EOP anti-spam policy settings](recommended-settings-for-eop-and-office365.md#eop-anti-spam-policy-settings). + ³ You can this use value as a condition in mail flow rules to filter or route the message. - ⁴ For **High confidence phishing**, the **Move message to Junk Email folder** action has effectively been deprecated. Although you might be able to select that action, high confidence phishing messages are always quarantined (equivalent to selecting **Quarantine message**). + ⁴ If the spam filtering verdict quarantines messages by default (**Quarantine message** is already selected when you get to the page), the default quarantine policy name is shown in the **Select quarantine policy** box. If you _change_ the action of a spam filtering verdict to **Quarantine message**, the **Select quarantine policy** box is blank by default. A blank value means the default quarantine policy for that verdict is used. When you later view or edit the anti-spam policy settings, the quarantine policy name is shown. For more information about the quarantine policies that are used by default for spam filter verdicts, see [EOP anti-spam policy settings](recommended-settings-for-eop-and-office365.md#eop-anti-spam-policy-settings). - ⁵ Users can't release their own messages that were quarantined as high confidence phishing by anti-spam policies, regardless of how the quarantine policy is configured. If the policy allows users to release their own quarantined messages, users are instead allowed to _request_ the release of their quarantined high-confidence phishing messages. + ⁵ Users can't release their own messages that were quarantined as high confidence phishing, regardless of how the quarantine policy is configured. If the policy allows users to release their own quarantined messages, users are instead allowed to _request_ the release of their quarantined high-confidence phishing messages. - **Intra-Organizational messages to take action on**: Controls whether spam filtering and the corresponding verdict actions are applied to internal messages (messages sent between users within the organization). The action that's configured in the policy for the specified spam filter verdicts is taken on messages sent between internal users. The available values are: - **Default**: This is the default value. Currently, this value is the same as selecting **None**. The behavior for the value **Default** will eventually change to apply the action for high confidence phishing detections in the policy as if you selected **High confidence phishing messages**. Check the Message Center for announcements to changes in this setting. |
| security | Submissions Teams | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/submissions-teams.md | For more information about user reported message settings in the Defender portal :::image type="content" source="../../media/submissions-user-report-message-in-teams-client-click-report.png" alt-text="Screenshot of the final dialog to report a message in the Microsoft Teams client." lightbox="../../media/submissions-user-report-message-in-teams-client-click-report.png"::: > [!NOTE]- > If [reporting for Microsoft Purview Communication Compliance is turned off](/microsoftteams/communication-compliance#report-a-concern-in-microsoft-teams), users might not have the dropdown list to select **Security risk - Spam, phishing, malicious content**. Instead, they're shown a confirmation pop-up. + > If [reporting for Microsoft Purview Communication Compliance is turned off](/purview/communication-compliance-policies#user-reported-messages-policy), users might not have the dropdown list to select **Security risk - Spam, phishing, malicious content**. Instead, they're shown a confirmation pop-up. 3. In the confirmation dialog that opens, select **Close**. |
| security | Zero Hour Auto Purge | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/zero-hour-auto-purge.md | ZAP doesn't quarantine messages that are in the process of [Dynamic Delivery](sa > [!NOTE] > ZAP for Microsoft Teams is available only to customers with Microsoft Defender for Office 365 E5 and Defender for Office P2 subscriptions. >-> Currently, ZAP is available only for messages that are identified as malware or high confidence phishing. +> Currently, ZAP is available for internal messages that are identified as malware or high confidence phishing. +> +> Currently, blocking potentially malicious messages by ZAP is supported only for Teams Chats. Channels and external messages aren't supported. When a chat message is identified as potentially phishing or malicious in Microsoft Teams, ZAP blocks the message and quarantines it. This message is blocked for both the recipient and the sender. This protection feature applies only to messages in a chat or in a meeting within the organization. When a chat message is identified as potentially phishing or malicious in Micros :::image type="content" source="../../media/zero-hour-auto-purge-recipient.png" alt-text="Image showing how zero-hour auto purge works for the recipient." lightbox="../../media/zero-hour-auto-purge-recipient.png"::: -Admins can view and manage these quarantined message in the Quarantine view. For more information, see [Manage quarantined messages and files as an admin](quarantine-admin-manage-messages-files.md#use-the-microsoft-365-defender-portal-to-manage-microsoft-teams-quarantined-messages). Currently, you can't view or manage quarantined Teams messages unless you're an admin. +Admins can view and manage these quarantined messages in the Quarantine view. For more information, see [Manage quarantined messages and files as an admin](quarantine-admin-manage-messages-files.md#use-the-microsoft-365-defender-portal-to-manage-microsoft-teams-quarantined-messages). Currently, you can't view or manage quarantined Teams messages unless you're an admin. ### Zero-hour auto purge (ZAP) for high confidence phishing messages in Teams You can also configure exceptions to the ZAP policy. - Once you save the policy, the users in the exception list are exempt from the policy setting. - - Exceptions is only honored when all users in the chat are on the exception list. + - Exceptions are only honored when all users in the chat are on the exception list. - Group exceptions: You can also use PowerShell to create quarantine policies. Connect to [Exchange All parameters and values are defined in the following table. -|Parameter|Desciption|Value| +|Parameter|Description|Value| |||| |MalwareQuarantinePolicy|The quarantine policy to be applied for malware.|`AdminOnlyAccessPolicy`| |HighConfidencePhishQuarantinePolicy|The quarantine policy applied for High-confidence phish verdicts.|`AdminOnlyAccessPolicy`| |ExemptUsers|List of users exempt from ZAP.|`ExceptIfSentTo`| |ExemptGroups|List of groups exempt from ZAP.|`ExceptIfSentToMemberOf`|-|ExemptDomains|List of domains exempt frpm ZAP.|`ExceptIfRecipientDomainIs`| +|ExemptDomains|List of domains exempt from ZAP.|`ExceptIfRecipientDomainIs`| ## Zero-hour auto purge (ZAP) FAQ |
| solutions | Collaboration Governance First | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/collaboration-governance-first.md | Title: "Create your collaboration governance plan"- Previously updated : 08/12/2020 + Title: Create your collaboration governance plan + Last updated : 07/27/2023 -description: "Learn how to create your collaboration governance plan" +description: Learn how to create your collaboration governance plan # Create your collaboration governance plan Microsoft 365 creates new paradigms for technologies to support the business. Th Microsoft 365 governance should complement existing policies that govern on-premises environments. But, since the cloud enables new opportunities to support the business, it is important to understand these opportunities and think about a governance approach that creates an appropriate balance between user goals, business risk, and industry and regulatory requirements. -Thinking about governance first means starting your journey to the cloud with some key decisions to best position for overall success. Some of these decisions include: +Thinking about governance first means starting your Microsoft 365 journey with some key decisions to best position for overall success. Some of these decisions include: - Is external sharing supported and in what scenarios? [Learn more about external sharing](./collaborate-with-people-outside-your-organization.md). - Who can and how will groups, sites, and teams be provisioned? [Learn about how to control who has the ability to create groups](./manage-creation-of-groups.md). -- What type of content can be published in each type of environment ΓÇô and what features need to be enabled to prevent users from accidentally publishing information in inappropriate locations? [Learn about information protection in Microsoft 365](../compliance/information-protection.md).+- What type of content can be published in each type of environment ΓÇô and what features need to be enabled to prevent users from accidentally publishing information in inappropriate locations? [Learn about information protection in Microsoft 365](/purview/information-protection). There is no perfect answer to these questions ΓÇô the right answers are the ones that balance risk and benefit for your organization. ## What does governance mean for Microsoft 365? -Governance planning for Microsoft 365 is about making sure that you are protecting your critical information assets while minimizing risk. Governance includes several key areas, each of which needs to be planned, coordinated, and adapted to align with changing organizational needs and the evolution of the technology. +Governance planning for Microsoft 365 is about making sure that you are protecting your critical information assets while minimizing risk. Governance includes several key areas, each of which needs to be planned, coordinated, and adapted to align with changing organizational needs and the evolution of the technology. - **Operational Assurance** ΓÇô keeping the platform operational, ensuring performance. This is largely an IT task with most of the work provided by Microsoft. -- **Information Assurance** ΓÇô managing content throughout the life cycle, treating information as an asset including records management, compliance, and security. Information assurance requires an understanding of both business goals and regulatory requirements. Ideally, you want to use automated policies that prevent users from making mistakes or warn them in scenarios where they need to make an informed decision. Where it is not possible to enforced by policy, you need to plan for education and training.+- **Information Assurance** ΓÇô managing content throughout the life cycle, treating information as an asset, including records management, compliance, and security. Information assurance requires an understanding of both business goals and regulatory requirements. Ideally, you want to use automated policies that prevent users from making mistakes or warn them in scenarios where they need to make an informed decision. Where it is not possible to enforce by policy, you need to plan for education and training. -- **Outcomes Assurance** ΓÇô steering empowered site or team owners in the right direction to achieve business results. Outcomes assurance is largely about providing guidance to content authors and site, group and team owners ΓÇô ensuring that the appropriate training is available to ensure that they know how to make good choices to get desired outcomes within overall organizational standards and practices.+- **Outcomes Assurance** ΓÇô steering empowered site or team owners in the right direction to achieve business results. Outcomes assurance is largely about providing guidance to content authors and site, group, and team owners ΓÇô ensuring that the appropriate training is available to ensure that they know how to make good choices to get desired outcomes within overall organizational standards and practices. Governance planning should come first, but governance needs to be something that you continuously revisit in an iterative process. As your data estate changes over time, you will want to revisit your governance decisions to adapt to changing business needs and feature availability. You may find that you need greater oversight to ensure conformance. You may find that you need less oversight to encourage more creative application of core features. You may find that roles and responsibilities need to be updated to reflect changes in the solution or changes in how users are using different applications. -For example, one of the key empowering capabilities of Microsoft 365 is the ability to easily work collaboratively with people outside your organization. Some organizations in some industries choose to block all external sharing. Others enable external sharing in specific scenarios or with specific organizations. There is no right or wrong governance decision when it comes to external sharing ΓÇô and there are many different scenarios where you can enable different settings in Microsoft 365 to allow sharing in some cases and block it in others. However, if you are just beginning your journey from an on-premises environment to the cloud, it is important to think about external sharing decisions and understand the benefits and risks associated with the different available options. +For example, one of the key empowering capabilities of Microsoft 365 is the ability to easily work collaboratively with people outside your organization. Some organizations in some industries choose to block all external sharing. Others enable external sharing in specific scenarios or with specific organizations. There is no right or wrong governance decision when it comes to external sharing ΓÇô and there are many different scenarios where you can enable different settings in Microsoft 365 to allow sharing in some cases and block it in others. If you are just beginning your journey from an on-premises environment to the cloud, it is important to think about external sharing decisions and understand the benefits and risks associated with the different available options. ## Think about governance first -Your investment in Microsoft 365 is only as good as the value of the content and experiences you enable ΓÇô so thinking about governance at the start of your journey ensures that you will neither lock down or enable too much before you have had a chance to understand and evaluate the implications of each decision. There are multiple "knobs and dials" you can turn in the Microsoft 365 admin center and for individual sites and teams. An effective governance plan is critical to achieve business goals ΓÇô but governance is about balancing risk with benefits. If we lock everything down, people will find a way to work around the rules if they need to do so to get work done. +Your investment in Microsoft 365 is only as good as the value of the content and experiences you enable ΓÇô so thinking about governance at the start of your journey ensures that you neither lock down or enable too much before you have had a chance to understand and evaluate the implications of each decision. There are multiple "knobs and dials" you can turn in Microsoft 365. An effective governance plan is critical to achieve business goals ΓÇô but governance is about balancing risk with benefits. If we lock everything down, people will find a way to work around the rules if they need to do so to get work done. Thinking about governance first allows you to: Thinking about governance first allows you to: - **Adapt to different organizations and different types of content and scenarios**. Governance decisions are unique decisions for each organization ΓÇô one size does not fit all. Not only does each organization have different governance needs, but governance decisions are often not the same for each type of content in Microsoft 365. For example, governance for team content may be different from governance for intranet content and from individual content in OneDrive. -- **Align to business priorities**. The time to start thinking about governance is when you are identifying the key business priorities for the solutions you build in Microsoft 365. These key business outcomes define the context for governance planning. This is important because your business goals will help you define how much time and energy you need to invest in governance. For example, if improving content discoverability across the organization is not very important, you probably do not need to spend too much time focused on enforcing or planning file naming conventions. If, on the other hand, you want to help reduce instances of multiple versions of the same document in various repositories across the enterprise, then your governance decisions will need processes and policies and training to ensure that content authors understand how to name files and follow "one copy of a document" guidance to make sure content is posted in only one location. It also means that you need a process to ensure that you are not unnecessarily creating more than one site or team for the same purpose.+- **Align to business priorities**. The time to start thinking about governance is when you are identifying the key business priorities for the solutions you build in Microsoft 365. These key business outcomes define the context for governance planning. This is important because your business goals can help you define how much time and energy you need to invest in governance. For example, if improving content discoverability across the organization is not very important, you probably do not need to spend too much time focused on enforcing or planning file naming conventions. If, on the other hand, you want to help reduce instances of multiple versions of the same document in various repositories across the enterprise, then your governance decisions need processes and policies and training to ensure that content authors understand how to name files and follow "one copy of a document" guidance to make sure content is posted in only one location. It also means that you need a process to ensure that you are not unnecessarily creating more than one site or team for the same purpose. ## How should we be communicating about governance? -Many governance decisions can be implemented by turning on or off features in Microsoft 365. That can help enforce your governance standards but it may not help the people in your organization understand what is available to them and why (or why not). +Many governance decisions can be implemented by turning on or off features in Microsoft 365. That can help enforce your governance standards but it may not help the people in your organization understand what is available to them and why (or why not). Traditionally, governance teams have created long documents outlining every governance decision. Unfortunately, those long documents rarely got read ΓÇô which meant that governance requirements that rely on people to enforce rarely worked. Try to avoid creating long documents targeted to multiple audiences as you think about how to communicate your key governance decisions. Instead, think about these alternatives: -- **Embed governance decisions directly in the solutions you create**. If you want to ensure that sensitive information is protected throughout Microsoft 365, implement sensitivity labels to ensure that your users don't accidentally expose information that they shouldn't. Block the applications where you can't provide the appropriate protection. [Learn more about sensitivity labels](../compliance/sensitivity-labels.md).+- **Embed governance decisions directly in the solutions you create**. If you want to ensure that sensitive information is protected throughout Microsoft 365, implement sensitivity labels to ensure that your users don't accidentally expose information that they shouldn't. Block the applications where you can't provide the appropriate protection. [Learn more about sensitivity labels](/purview/sensitivity-labels). - **Reinforce with training**. Adapt solutions such as [Microsoft 365 learning pathways](/office365/customlearning) to ensure that your organization-specific expectations are reinforced with Microsoft-provided training. -- **Deliver as a site, not a document**. Create your own Microsoft 365 Adoption Center in a SharePoint communication site to ensure that your content authors and site and team owners understand not just "how to" but also "how should." Create topic-specific pages that address different business scenarios to provide both guidance and best practice to leverage or enable different capabilities in SharePoint and Teams and other applications to achieve business outcomes.+- **Deliver as a site, not a document**. Create your own Microsoft 365 Adoption Center in a SharePoint communication site to ensure that your content authors and site and team owners understand not just "how to" but also "how should." Create topic-specific pages that address different business scenarios to provide both guidance and best practice to use or enable different capabilities in SharePoint and Teams and other applications to achieve business outcomes. Make these pages part of your [SharePoint intranet](/sharepoint/plan-intranet). ## What are the key success factors? Work through the key governance decisions ΓÇô but don't try to make every decisi In addition to external sharing, discussed earlier, another key decision for every organization is how to provision sites and groups. For example, consider the following: -- Because it is so easy for users to create Microsoft 365 groups, you may want to open group creation so that IT is not inundated with requests to create them on behalf of other people. To avoid "group sprawl," you could create a custom workflow that sends an email with governance, training, and other information to group creators soon after the group is created. (For example, "You just created a site/team, community, etc. -- here are your responsibilities and links to training...") On the other hand, depending on your business, you might want to control who has the ability to create groups.+- Because it is so easy for users to create Microsoft 365 groups and teams, you may want to open group and team creation so that IT is not inundated with requests to create them on behalf of other people. To avoid sprawl, you could create a custom workflow that sends an email with governance, training, and other information to group and team creators. (For example, "You just created a site/team, community, etc. -- here are your responsibilities and links to training...") On the other hand, depending on your business, you might want to control who has the ability to create groups. - If you want to control how SharePoint sites are created, you can hide the **Create site** link on the SharePoint start page. Create a custom form, or create a custom site design and site script to automate provisioning new modern SharePoint sites using a pre-defined site structure that can include links to your governance and training best practices. Business outcome goals should be the primary driver for your governance decision - Try not to be trapped in "It's what we've always done." The cloud and increasing globalization of many organizations introduces new opportunities. Challenge assumptions if they do not align with business goals. Can you relax the rules for some scenarios or for some people? Can you get the same business outcome using the features of Microsoft 365 rather than blocking an activity entirely? -- If you lock everything down, people will find a work-around. Try to understand the key business scenarios your users want to enable and provide guidelines and training as appropriate. +- If you lock everything down, people will find a work-around. Try to understand the key business scenarios your users want to enable and provide guidelines and training as appropriate. - Consider incorporating activities to review key sites and activities to make sure that site and team owners are following your governance guidance. ### Define roles and responsibilities -In addition to your governance team, there are several other key roles or teams that you will want to think about to position for success with Microsoft 365. Some roles may be combined or filled by the same person and others may not be appropriate for all organizations. Most organizations have an Executive Sponsor for Microsoft 365 as a whole and some also have a Steering Committee or team either for Microsoft 365 as a whole or just for the intranet. [Learn more about the comprehensive admin roles and permissions available in Microsoft 365](../admin/add-users/admin-roles-page.md). +In addition to your governance team, there are several other key roles or teams that can help position your organization for success with Microsoft 365. Some roles may be combined or filled by the same person and others may not be appropriate for all organizations. Most organizations have an Executive Sponsor for Microsoft 365 as a whole and some also have a Steering Committee or team either for Microsoft 365 as a whole or just for the intranet. [Learn more about the comprehensive admin roles and permissions available in Microsoft 365](/microsoft-365/admin/add-users/admin-roles-page). ### Revisit as business and technology changes Governance for Microsoft 365 is not "once and done." Have a plan to stay on top Ultimately, the success of your governance planning efforts depends on how well you have communicated expectations to the members of your organization. In addition to the suggestions described earlier, consider the following: -- Can you incorporate "how should" with your "how to" training? In other words, can you create a "user resource center" for Microsoft 365 where you can provide resources and training to help provide guidance and training that will help users adopt Microsoft 365 effectively? The best governance content provides guidance that helps all users adopt and get the most value from Microsoft 365.+- Can you incorporate "how should" with your "how to" training? In other words, can you create a "user resource center" for Microsoft 365 where you can provide resources and training to help provide guidance and training that helps users adopt Microsoft 365 effectively? The best governance content provides guidance that helps all users adopt and get the most value from Microsoft 365. - Should you create a certification and re-certification for site and team owners? -- Can you create a Microsoft 365 Champions program for your organization? In addition, consider joining the worldwide [Microsoft 365 champions program](https://aka.ms/O365Champions) to get ideas and approaches for your own champions program and to connect with like-minded people and thought leaders from within and around Microsoft.+- Can you create a Microsoft 365 Champions program for your organization? Consider joining the worldwide [Microsoft 365 champions program](https://aka.ms/O365Champions) to get ideas and approaches for your own champions program and to connect with like-minded people and thought leaders from within and around Microsoft. ## Related topics |
| solutions | Collaboration Governance Overview | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/collaboration-governance-overview.md | Title: "A collaboration governance framework for Microsoft 365"- Previously updated : 08/12/2020 + Title: A collaboration governance framework for Microsoft 365 + Last updated : 07/27/2023 -description: "Learn governance best practices for Microsoft 365 collaboration tools, including Microsoft 365 Groups, Teams, SharePoint, and Viva Engage." +description: Learn governance best practices for Microsoft 365 collaboration tools, including Microsoft 365 Groups, Teams, SharePoint, and Viva Engage. # What is collaboration governance? Collaboration governance is how you manage users' access to resources, compliance with your business standards, and ensure the security of your data. -Organizations today are using a diverse tool set. There's the team of developers using team chat, the executives sending email, and the entire organization connecting over enterprise social. Multiple collaboration tools are in use because every group is unique and has their own functional needs and work style. Some will use only email while others will live primarily in chat. +Organizations today are using a diverse tool set. There's the team of developers using team chat, the executives sending email, and the entire organization connecting over enterprise social. Multiple collaboration tools are in use because every group is unique and has their own functional needs and work style. Some will use only email while others will live primarily in chat. -If users feel the IT-provided tools do not fit their needs, they will likely download their favorite consumer app which supports their scenarios. Although this process allows users to get started quickly, it leads to a frustrating user experience across the organization with multiple logins, difficulty sharing, and no single place to view content. This concept is referred to as ΓÇ£Shadow ITΓÇ¥ and poses a significant risk to organizations. It reduces the ability to uniformly manage user access, ensure security, and service compliance needs. +If users feel the IT-provided tools do not fit their needs, they will likely download their favorite consumer app which supports their scenarios. Although this process allows users to get started quickly, it leads to a frustrating user experience across the organization with multiple logins, difficulty sharing, and no single place to view content. This concept is referred to as "Shadow IT" and poses a significant risk to organizations. It reduces the ability to uniformly manage user access, ensure security, and service compliance needs. -Services such as Microsoft 365 groups, Teams, and Viva Engage empower users and reduces the risk of shadow IT by providing the tools needed to collaborate. Microsoft 365 has a rich set of tools to implement any governance capabilities your organization might require. +Services such as Microsoft 365 groups, Teams, and Viva Engage empower users and reduces the risk of shadow IT by providing the tools needed to collaborate. Microsoft 365 has a rich set of tools to implement any governance capabilities your organization might require.  If your organization is multi-national and you have data residency requirements ## Why Microsoft 365 groups are important in collaboration governance -Microsoft 365 groups lets you choose a set of people with whom you wish to collaborate, and easily set up a collection of resources for those people to share. Adding members to the group automatically grants the needed permissions to all assets provided by the group. Both Teams and Viva Engage use Microsoft 365 groups to manage their membership. +Microsoft 365 groups let you choose a set of people with whom you wish to collaborate, and easily set up a collection of resources for those people to share. Adding members to the group automatically grants the needed permissions to all assets provided by the group. Both Teams and Viva Engage use Microsoft 365 groups to manage their membership. -Microsoft 365 groups include a suite of linked resources that users can use for communication and collaboration. Groups always include a SharePoint site, Planner, a Power BI workspace, a mailbox and calendar, and Stream. Depending on how you create the group, you can optionally add other services such as Teams, Viva Engage, and Project. +Microsoft 365 groups include a suite of linked resources that users can use for communication and collaboration. Groups always include a SharePoint site, Planner, and a mailbox and calendar. Depending on how you create the group, you can optionally add other services such as Teams, Viva Engage, and Project.  |Resource|Description| |:|:-|-|[Calendar](https://support.office.com/article/schedule-a-meeting-on-a-group-calendar-in-outlook-0cf1ad68-1034-4306-b367-d75e9818376a)|For scheduling events related to the group| -|[Inbox](https://support.office.com/article/have-a-group-conversation-in-outlook-a0482e24-a769-4e39-a5ba-a7c56e828b22)|For email conversations between group members. This inbox has an email address and can be set to accept messages from people outside the group and even outside your organization, much like a traditional distribution list.| -|[OneNote notebook](https://support.office.com/article/get-started-with-onenote-e768fafa-8f9b-4eac-8600-65aa10b2fe97)|For gathering ideas, research, and information| -|[Planner](https://support.office.com/article/microsoft-planner-help-4a9a13c6-3adf-4a60-a6fc-15c0b15e16fc)|For assigning and managing project tasks among your group members| -|[Power BI Workspace](/power-bi/collaborate-share/service-new-workspaces)|A data collaboration space with dashboards and reports| +|[Calendar](https://support.office.com/article/0cf1ad68-1034-4306-b367-d75e9818376a)|For scheduling events related to the group| +|[Inbox](https://support.office.com/article/a0482e24-a769-4e39-a5ba-a7c56e828b22)|For email conversations between group members. This inbox has an email address and can be set to accept messages from people outside the group and even outside your organization, much like a traditional distribution list.| +|[OneNote notebook](https://support.office.com/article/e768fafa-8f9b-4eac-8600-65aa10b2fe97)|For gathering ideas, research, and information| +|[Planner](https://support.office.com/article/4a9a13c6-3adf-4a60-a6fc-15c0b15e16fc)|For assigning and managing project tasks among your group members| |[Project and Roadmap](https://support.microsoft.com/project)|Web-based project management tools|-|[SharePoint team site](https://support.office.com/article/what-is-a-sharepoint-team-site-75545757-36c3-46a7-beed-0aaa74f0401e)|A central repository for information, links and content relating to your group| -|[Stream](https://support.microsoft.com/microsoft-stream)|A video streaming service| +|[SharePoint team site](https://support.office.com/article/75545757-36c3-46a7-beed-0aaa74f0401e)|A central repository for information, links and content relating to your group| |[Teams](https://support.microsoft.com/teams)|A chat-based workspace in Microsoft 365|-|[Viva Engage group](https://support.office.com/article/Learn-about-Office-365-groups-b565caa1-5c40-40ef-9915-60fdb2d97fa2)|A common place to have conversations and share information| +|[Viva Engage](https://support.office.com/article/b565caa1-5c40-40ef-9915-60fdb2d97fa2)|A common place to have conversations and share information| Microsoft 365 Groups includes a variety of governance controls, including an expiration policy, naming conventions, and a blocked words policy, to help you manage groups in your organization. Because groups control membership and access to this suite of resources, managing groups is a key part of governing collaboration in Microsoft 365. There are multiple places to collaborate and have conversations within Microsoft There are three main communication methods supported by Microsoft 365: -- Outlook: collaboration through email with a shared group inbox and calendar+- Outlook: collaboration through email, including with a shared group inbox and calendar - Microsoft Teams: a persistent-chat-based workspace where you can have informal, real-time, conversations around a variety of topics, organized by specific sub-groups - Viva Engage: enterprise social experience for collaboration - --- Teams: chat-based workspace (high velocity collaboration) ΓÇô inner loop+**Teams: chat-based workspace (high velocity collaboration)** - Built for collaboration with the people your users work with every day - Puts information at the fingertips of users in a single experience - Add tabs, connectors and bots - Live chat, audio/video conferencing, recorded meetings -- Viva Engage: connect across the org (enterprise social) ΓÇô outer loop+**Viva Engage: connect across the org (enterprise social)** - Communities of practice - Cross-functional groups of people who share a common interest or expertise but are not necessarily working together on a day-to-day basis - Leadership connection, learning communities, role-based communities -- Mailbox and calendar (email-based collaboration)- - Used for targeted communication with a group of people +**Mailbox and calendar (email-based collaboration)** + - Used for targeted communication with individuals or a group of people - Shared calendar for meetings with other group members- + As you determine how you want to use collaboration features in Microsoft 365, consider these methods of communication and which your users are likely to use in different scenarios. > [!NOTE]-> When a new Office 365 Group is created via Viva Engage or Teams, the group isn't visible in Outlook or the address book because the primary communication between those users happens in their respective clients. Viva Engage groups cannot be connected to Teams. +> When a new Microsoft 365 group is created via Viva Engage or Teams, the group isn't visible in Outlook or the address book because the primary communication between those users happens in their respective clients. Viva Engage groups cannot be connected to Teams. ## Collaboration governance best practices checklist As you start your governance planning process, keep these best practices in mind - **Embed governance decisions directly in the solutions you create** - many governance decisions can be implemented by turning on or off features in Microsoft 365. - - **Use a phased approach** - Roll collaboration features out to a small group of users first. Get feedback from them, watch for help desk tickets, and update any needed settings or processes before proceeding to a larger group. - **Reinforce with training** - adapt solutions such as [Microsoft 365 learning pathways](/office365/customlearning) to ensure that your organization-specific expectations are reinforced with Microsoft-provided training. -- **Have a strategy for communicating governance policies and guidelines in your organization** - create a Microsoft 365 Adoption Center in a SharePoint communication site to communicate policies and procedures.+- **Have a strategy for communicating governance policies and guidelines in your organization** - create a Microsoft 365 Adoption Center in a [SharePoint communication site](https://support.microsoft.com/en-us/office/7fb44b20-a72f-4d2c-9173-fc8f59ba50eb) to communicate policies and procedures. - **Define roles and responsibilities** - identify your governance core team and work through key governance decisions about provisioning and naming and external access first, and then work through the remaining decisions. For a closer look at these practices, read [Create your collaboration governance Because groups and teams can be created in several ways, we recommend training your users to use the method that fits your organization the best: +- If your organization has deployed Teams, instruct your users to create a team when they need a collaboration space. - If your organization does most of its communication using email, instruct your users to create groups in Outlook. - If your organization heavily uses SharePoint or is migrating from SharePoint on-premises, instruct your users to create SharePoint team sites for collaboration.-- If your organization has deployed Teams, instruct your users to create a team when they need a collaboration space. This helps avoid confusion if users are unfamiliar with how groups relate to their related services. For more information about how to talk to your users about groups, see [Explaining Microsoft 365 Groups to your users](../admin/create-groups/explain-groups-knowledge-worker.md). Governance capabilities for collaboration in Microsoft 365 include features in M |Group expiration policy|Set inactive groups and teams to expire and be deleted after a specified period of time.|Microsoft 365 E5 or E3 with Azure AD Premium licenses| |Per-group guest access|Allow or prevent team and group sharing with people outside your organization on a per-group basis.|Microsoft 365 E5 or E3| +Additionally, these add-on licenses provide enhanced governance capabilities: ++- [Microsoft Teams Premium](/microsoftteams/enhanced-teams-experience) provides compliance capabilities for meetings, including watermarks, encryption, and sensitivity labels. +- [Microsoft Syntex - SharePoint Advanced Management](/sharepoint/advanced-management) provides policies for content access, collaboration and lifecycle management. + ## Collaboration governance planning recommendations Follow these basic steps to create your governance plan: Follow these basic steps to create your governance plan: These training modules from Microsoft Learn can help you learn the governance features in Microsoft 365. -#### Information protection --|Training:|Manage information protection and governance| -|:|:| -||The amount of data being generated today is growing faster than ever, employees want to get work done everywhere, and the regulatory landscape is constantly changing. Microsoft's solutions for information protection and governance help organizations achieve the right balance between keeping their data protected and their people productive. This learning path can help you prepare for the Microsoft 365 Certified: Security Administrator Associate and Microsoft 365 Certified: Enterprise Administration Expert certifications.<br><br>5 hr 13 min - Learning Path - 7 Modules| --> [!div class="nextstepaction"] -> [Start >](/training/modules/m365-compliance-information-governance/introduction/) --<br><br> --|Training:|Protect enterprise information with Microsoft 365| -|:|:| -||Protecting and securing your organization's information is more challenging than ever. The Protect enterprise information with Microsoft 365 learning path discusses how to protect your sensitive information from accidental oversharing or misuse, how to discover and classify data, how to protect it with sensitivity labels, and how to both monitor and analyze your sensitive information to protect against its loss. This learning path can help you prepare for the Microsoft 365 Certified: Security Administrator Associate and Microsoft 365 Certified: Enterprise Administration Expert certifications.<br><br>1 hr - Learning Path - 5 Modules| --> [!div class="nextstepaction"] -> [Start >](/training/modules/m365-security-info-overview/introduction/) --#### Security and compliance --|Training:|Demonstrate fundamental knowledge of Microsoft 365 security and compliance capabilities| -|:|:| -||Learn about the Microsoft 365 security and compliance solutions areas and the capabilities available to help enterprises secure their enterprise and meet regulatory requirements. If you're unfamiliar with basic cloud computing concepts, we recommend you take [Cloud Concepts - Principles of cloud computing](/training/modules/principles-cloud-computing/index).<br><br>3 hr 11 min - Learning Path - 8 Modules| --> [!div class="nextstepaction"] -> [Start >](/training/modules/what-is-m365/1-introduction/) +- [Introduction to information protection and data lifecycle management in Microsoft Purview](/training/modules/m365-compliance-information-governance) - Learn how Microsoft 365 information protection and data lifecycle management solutions help you protect and govern your data, throughout its lifecycle. +- [Microsoft Security, Compliance, and Identity Fundamentals: Describe the capabilities of Microsoft compliance solutions](/training/paths/describe-capabilities-of-microsoft-compliance-solutions/) - Learn about compliance solutions in Microsoft. Topics covered will include compliance, information protection, and governance in Microsoft 365, Insider Risk, audit, and eDiscovery solutions. Also covered are Azure resources governance capabilities. ## Illustrations Microsoft 365 includes a broad set of information protection and compliance capa This set of illustrations uses one of the most regulated industries, financial services, to demonstrate how these capabilities can be applied to address common regulatory requirements. Feel free to adapt these illustrations for your own use. - | Item | Description | |:--|:--| |[](https://download.microsoft.com/download/3/a/6/3a6ab1a3-feb0-4ee2-8e77-62415a772e53/m365-compliance-illustrations.pdf) <br/> English: [Download as a PDF](https://download.microsoft.com/download/3/a/6/3a6ab1a3-feb0-4ee2-8e77-62415a772e53/m365-compliance-illustrations.pdf) \| [Download as a Visio](https://download.microsoft.com/download/3/a/6/3a6ab1a3-feb0-4ee2-8e77-62415a772e53/m365-compliance-illustrations.vsdx) <br/> Japanese: [Download as a PDF](https://download.microsoft.com/download/6/f/1/6f1a7d0e-dd8e-442e-b073-8e94327ae4f8/m365-compliance-illustrations.pdf) \| [Download as a Visio](https://download.microsoft.com/download/6/f/1/6f1a7d0e-dd8e-442e-b073-8e94327ae4f8/m365-compliance-illustrations.vsdx) <br/> Updated November 2020|Includes: <ul><li> Microsoft Purview Information Protection and Microsoft Purview Data Loss Prevention</li><li>Retention policies and retention labels </li><li>Information barriers</li><li>Communication compliance</li><li>Insider risk</li><li>Third-party data ingestion</li>| -## Conference sessions --Watch these conference sessions to learn more about governance for Microsoft 365 Groups and Teams. --**Fundamentals** --Learn the fundamentals and new innovations in Microsoft 365 Groups, including management and governance at scale, best practices for driving usage and adoption, and self-service. --- [Embrace Microsoft 365 Groups](https://www.youtube.com/watch?v=dAamBF1gb7M)--**Governance** --Learn how to set up your groups expiry lifecycle, naming policies, classification labels, collaboration with external guests, and manage group creation permissions. --- [Transform collaboration and fight shadow IT with Office 365 Groups](https://www.youtube.com/watch?v=Bhf_bKx3lAg)--**Customer example** --See a behind-the-scenes example of how Microsoft 365 Groups, SharePoint, Teams, and Viva Engage work together to provide a global collaboration platform. --- [Finding your collaboration sweet spot with Microsoft 365 Groups, SharePoint, Teams, and Viva Engage](https://www.youtube.com/watch?v=Rx9eVwqXeQk)--## See also +## Related topics [Microsoft 365 security documentation](../security/index.yml) |
| solutions | Groups Sharepoint Governance | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/groups-sharepoint-governance.md | Title: "Settings interactions between Microsoft 365 Groups and SharePoint"- Previously updated : 08/12/2020 + Title: SharePoint and Microsoft 365 Groups integration (IT Admins) + Last updated : 07/27/2023 -description: "Learn about settings interactions between Microsoft 365 Groups and SharePoint" +description: Learn how admin settings for Microsoft 365 Groups and SharePoint can affect each other and the user experience. -# Settings interactions between Microsoft 365 Groups and SharePoint +# SharePoint and Microsoft 365 Groups integration (IT Admins) Some settings for Microsoft 365 Groups and SharePoint in Microsoft 365, particularly related to sharing and group and team site creation, overlap with each other. This article provides descriptions of these interactions and best practices for how to work with these settings. Some settings for Microsoft 365 Groups and SharePoint in Microsoft 365, particul |SharePoint setting|Description|Effect on Microsoft 365 groups|Recommendation| |:--|:-|:--|:-|-|External sharing for organization and site|Determines if sites, files, and folders can be shared with people outside the organization.|If SharePoint and groups settings don't match, guests in the group may be blocked from accessing the site, or external access may be available in the site but not the group.|When changing sharing settings, check both Groups settings and SharePoint site settings for group-connected team sites.<br><br>See [Collaborate with guests in a site](./collaborate-in-site.md).| -|Domain allow/block|Allows or prevents content being shared with specified domains.|Groups does not recognize SharePoint allowlists or blocklists. Users from domains disallowed in SharePoint could gain access to SharePoint through a group.|Manage domain allowlists or blocklists for Azure AD and SharePoint together. Create an org-wide governance process for allowing and blocking domains.<br><br>See [SharePoint domain settings](/sharepoint/restricted-domains-sharing) and [Azure AD domain settings](/azure/active-directory/b2b/allow-deny-list)| -|Allow only users in specific security groups to share externally|Specifies security groups who can share sites, folders, and files externally.|This setting does not affect group owners sharing groups externally. Group guests have access to the associated SharePoint site.|| -|SharePoint site sharing settings|Determines who can share the site directly outside of group membership. This is configured by the group or site owner.|This setting does not affect the group directly, but it can allow users to be added to a site and not have access to other group resources|Consider using this setting to limit sharing of the site directly and manage site access through the group.| +|External sharing for organization and site|Determines if sites, files, and folders can be shared with people outside the organization.|If SharePoint and Microsoft 365 Groups settings don't match, guests in the group may be blocked from accessing the site, or external access may be available in the site but not the group.|When changing sharing settings, check both Microsoft 365 Groups settings and SharePoint site settings for group-connected team sites.<br><br>See [Collaborate with guests in a site](./collaborate-in-site.md).| +|Domain allow/block|Allows or prevents content being shared with specified domains.|Microsoft 365 Groups doesn't recognize SharePoint allowlists or blocklists. Users from domains disallowed in SharePoint could gain access to SharePoint through a group.|Manage domain allowlists or blocklists for Azure AD and SharePoint together. Create an org-wide governance process for allowing and blocking domains.<br><br>See [SharePoint domain settings](/sharepoint/restricted-domains-sharing) and [Azure AD domain settings](/azure/active-directory/b2b/allow-deny-list)| +|Allow only users in specific security groups to share externally|Specifies security groups who can share sites, folders, and files externally.|This setting doesn't affect group owners sharing Microsoft 365 groups externally. Group guests have access to the associated SharePoint site.|| +|SharePoint site sharing settings|Determines who can share the site directly outside of group membership. (The group or site owner configures this setting.)|This setting doesn't affect the group directly, but it can allow users to be added to a site and not have access to other group resources|Consider using this setting to limit sharing of the site directly and manage site access through the group.| |Let users create sites from the SharePoint start page and OneDrive|Specifies if users can create new SharePoint sites.|If this setting is turned off, users can still create group-connected team sites by creating a group.|| -## The effects of Microsoft 365 groups setting on SharePoint +## The effects of Microsoft 365 Groups settings on SharePoint -|Microsoft 365 groups setting|Description|Effect on SharePoint|Recommendation| +|Microsoft 365 Groups setting|Description|Effect on SharePoint|Recommendation| |:|:-|:-|:-| |Naming policies|Specifies group name prefixes and suffixes, and blocked words for group creation|Policies are enforced for users creating group-connected team sites, but not communication sites or sites with other templates.|Create separate naming guidance for communication sites if needed.|-|Group guest access|Specifies if people outside the organization can be added to groups.|If SharePoint and groups settings don't match, guests in the group may be blocked from accessing the site, or external access may be available in the site but not the group.|When changing sharing settings, check both Groups settings and SharePoint site settings for group-connected team sites.<br><br>See [Collaborate with guests in a site](./collaborate-in-site.md)| -|Group creation by security group|Groups can only be created by members of a specific security group.|Users who are not members of the security group will not be able to create a group-connected team site.|Be sure your process for requesting a group includes instructions for requesting a site.| -|Group expiration policy|Specifies a time period after which groups that are not actively used will be automatically deleted.|When the group is deleted, the associated SharePoint site is also deleted. Content protected by retention policies is retained.|Use expiration policies to avoid sprawl of unused groups and sites.| +|Group guest access|Specifies if people outside the organization can be added to groups.|If SharePoint and Microsoft 365 Groups settings don't match, guests in the group may be blocked from accessing the site, or external access may be available in the site but not the group.|When changing sharing settings, check both Microsoft 365 Groups settings and SharePoint site settings for group-connected team sites.<br><br>See [Collaborate with guests in a site](./collaborate-in-site.md)| +|Group creation by security group|Only members of a specific security group can create Microsoft 365 groups.|Users who aren't members of the security group can't create a group-connected team site.|Be sure your process for requesting a group includes instructions for requesting a site.| +|Group expiration policy|Specifies a time period after which Microsoft 365 groups that aren't actively used are automatically deleted.|When the group is deleted, the associated SharePoint site is also deleted. Content protected by retention policies is retained.|Use expiration policies to avoid sprawl of unused Microsoft 365 groups and sites.| ## Related topics |
| syntex | Image Tagging Overview | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/syntex/image-tagging-overview.md | + + Title: Overview of image tagging in Microsoft Syntex ++++audience: admin + Last updated : 07/27/2023+++search.appverid: ++ - enabler-strategic + - m365initiative-syntex +ms.localizationpriority: medium ++description: Learn about image tagging in Microsoft Syntex. +++# Overview of image tagging in Microsoft Syntex ++Microsoft Syntex makes it easier to find and manage images in SharePoint document libraries. It does this process by automatically tagging images with descriptive keywords using AI. These keywords are stored in a managed metadata column (the **Image Tags** column), which makes it easier to search, sort, filter, and manage the images. ++ ++The image tagging feature makes it even easier to tag images without any training, thereby reducing the need for manual tagging or custom AI model building. This result means you can quickly find images in your libraries and set up processes based on the tags for the images. ++## Requirements and limitations ++### Supported file types ++Image tagging is available for the following image file types: .bmp, .png, .gif, .jpeg, .jpg, .tif, .tiff, .ari, .arw, .bay, .cap, .crw, .cr2, .cr3, .dcr, .dcs, .dng, .drf, .eip, .erf, .fff, .heic, .heif, .iiq, .kdc, .k25, .mef, .mos, .mrw, .nef, .nrw, .orf, .pef, .ptx, .pxn, .raf, .raw, .rwl, .rw2, .sr2, .srf, .srw, .x3f, and .3fr. ++### Current release notes ++- **Time taken to reflect tags getting in the **Image Tags** column:** Minimum: 5 minutes, maximum: 24 hours. ++- **Image Tags is an editable taxonomy column:** You can add new tags or remove the AI-generated tags as needed to meet your requirements. ++- **Custom metadata already applied:** If the image already has custom metadata applied to it, that information is extracted and shown in the **Image Tags** column. ++- **Existing image processing:** Currently, existing images aren't processed when image tagger is enabled. Any newly uploaded images are processed for automatic image tagging. ++- **Responsible AI guidelines:** Send us feedback on the image tagging quality. We monitor feedback closely and take appropriate action based on the feedback. ++++<! +# Set up image tagging in Microsoft Syntex ++(Coming soon) ++With image tagging in Microsoft Syntex, users can find images through search by searching on image tags, and create workflows based on image tags. By default, basic image tagging is turned on for SharePoint and OneDrive. Images uploaded to either location are automatically scanned and applicable tags are applied, if available, from a list of 37 basic tags. Users can find images through search by searching on the image tags. ++When a user uploads an image, the tagging process runs automatically. If an image is edited, the tagging process runs again to update the tags. ++Users with permissions to the image file can see and edit the tags in the file information panel or in the search results page. Once a user edits an image's tags, the system no longer auto-tags that image, even if it's edited. ++If you turn tagging off, images will no longer be automatically tagged. Existing tags won't be removed. ++> [!NOTE] +> System generated tags may change with updates to the image or our tag technology. ++## Configure image tagging ++After you [set up Syntex](set-up-content-understanding.md), you can configure image tagging in the Microsoft 365 admin center. ++To turn image tagging on or off ++1. In the Microsoft 365 admin center, select <a href="https://go.microsoft.com/fwlink/p/?linkid=2171997" target="_blank">**Setup**</a>. ++2. Under **Organizational knowledge**, click **Automate content understanding**. ++3. Click **Manage**. ++4. On the **Image tagging** tab, click **Edit**. ++5. Choose to allow **Basic tagging** or turn tagging **Off**. ++6. Click **Save**. ++  +> |
| syntex | Image Tagging Setup | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/syntex/image-tagging-setup.md | + + Title: Set up and manage image tagging in Microsoft Syntex ++++audience: admin + Last updated : 07/27/2023++++search.appverid: ++ - enabler-strategic + - m365initiative-syntex +ms.localizationpriority: medium +description: Learn how to set and configure image tagging in Microsoft Syntex. +++# Set up and manage image tagging in Microsoft Syntex ++The image tagging service for Microsoft Syntex is set up in the Microsoft 365 admin center. ++## Prerequisites ++### Licensing ++Before you can use image tagging in Syntex, you must first link an Azure subscription in [Syntex pay-as-you-go](syntex-azure-billing.md). Image tagging in Syntex is billed based on the [type and number of transactions](syntex-pay-as-you-go-services.md). ++### Permissions ++You must have Global admin or SharePoint admin permissions to be able to access the Microsoft 365 admin center and set up image tagging in Syntex. ++## Set up image tagging ++After an [Azure subscription is linked to Microsoft Syntex](syntex-azure-billing.md), image tagging will be automatically set up and enabled for all SharePoint sites. ++Although you enable pay-as-you-go billing for image tagging, you'll be charged only when [image tagging is enabled on a document library](image-tagging.md). ++## Manage sites ++By default, image tagging is available for libraries on all SharePoint sites. To turn off image tagging on all sites, follow these steps. ++1. In the Microsoft 365 admin center, select <a href="https://go.microsoft.com/fwlink/p/?linkid=2171997" target="_blank">**Setup**</a>, and then select **Use content AI with Microsoft Syntex**. ++2. On the **Use content AI with Microsoft Syntex** page, select **Manage Microsoft Syntex**. ++3. On the **Manage Microsoft Syntex** page, select **Image tagging**. ++4. On the **Image tagging** page, select **No libraries**, and then select **Save**. + |
| syntex | Image Tagging | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/syntex/image-tagging.md | description: Learn how to use image tagging to search, sort, filter, and manage # Find and manage images using image tagging in Microsoft Syntex -Microsoft Syntex makes it easier to find and manage images in SharePoint document libraries. It does this by automatically tagging images with descriptive keywords using AI. These keywords are stored in a managed metadata column (the **Image Tags** column), which makes it easier to search, sort, filter, and manage the images. --The image tagging feature makes it even easier to tag images without any training, thereby reducing the need for manual tagging or custom AI model building. This means you can quickly find images in your libraries and set up processes based on the tags for the images. --> [!NOTE] -> Syntex image tagger is available on a [pay-as-you-go basis](syntex-pay-as-you-go-services.md) and is not included in the Syntex seat license. --## To enable image tagging in a library --There are two methods you can use to enable image tagging in a document library: +Before you can use image tagging, you need to enable it in a document library. There are two methods you can use to do this: - [Use an existing **Image Tags** column](#use-an-existing-image-tags-column) - [Enable the **Image Tags** column](#enable-the-image-tags-column) -### Use an existing Image Tags column +## Use an existing Image Tags column If you already have an [**Image Tags** column in your library](https://support.microsoft.com/office/work-with-image-tags-in-a-sharepoint-library), use these steps to enable enhanced image tagging: If you already have an [**Image Tags** column in your library](https://support.m 3. Once enabled, any new images uploaded to the library are tagged with the descriptive keywords. -### Enable the Image Tags column +## Enable the Image Tags column If you don't have an **Image Tags** column in your library, use these steps to enable enhanced image tagging: If you don't have an **Image Tags** column in your library, use these steps to e 3. Once the **Image Tags** column is configured, you can upload images. The relevant tags are displayed in the library for each image. -- > [!NOTE] - >- **Supported image file types:** .bmp, .png, .gif, .jpeg, .jpg, .tif, .tiff, .ari, .arw, .bay, .cap, .crw, .cr2, .cr3, .dcr, .dcs, .dng, .drf, .eip, .erf, .fff, .heic, .heif, .iiq, .kdc, .k25, .mef, .mos, .mrw, .nef, .nrw, .orf, .pef, .ptx, .pxn, .raf, .raw, .rwl, .rw2, .sr2, .srf, .srw, .x3f, and .3fr.<br> - >- **Time taken to reflect tags getting in the **Image Tags** column:** Minimum: 5 minutes, maximum: 24 hours.<br> - >- **Existing image processing:** Currently, existing images aren't processed when image tagger is enabled. Any newly uploaded images are processed for automatic image tagging.<br> - >- **Responsible AI guidelines:** Send us feedback on the image tagging quality. We monitor feedback closely and take appropriate action based on the feedback. --- <! # Set up image tagging in Microsoft Syntex |
| syntex | Set Up Microsoft Syntex | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/syntex/set-up-microsoft-syntex.md | The following table provides links to the specific setup instructions for each s |:-|:-| |Prebuilt document processing | [Set up prebuilt document processing](prebuilt-setup.md) | |Unstructured document processing | [Set up unstructured document processing](unstructured-setup.md) |-|Optical character recognition | [Set up optical character recognition](ocr.md#set-up-optical-character-recognition) | +|Image tagging | [Set up image tagging](image-tagging-setup.md) | +|Optical character recognition | [Set up optical character recognition](ocr.md) | |
| syntex | Syntex Azure Billing | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/syntex/syntex-azure-billing.md | The following tags are available: For more information about filter options in Cost Management, see [Group and filter options in Cost analysis](/azure/cost-management-billing/costs/group-filter). -## Related topics +## Related articles [Overview of Microsoft Syntex](syntex-overview.md) |
| syntex | Syntex Overview | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/syntex/syntex-overview.md | Both structured and freeform models use Microsoft Power Apps AI Builder to creat [Learn more about unstructured models in Microsoft Syntex.](document-understanding-overview.md) +### Image tagging ++ :::column span="3"::: + Use image tagging in Syntex to find and manage images in SharePoint document libraries. Syntex automatically tags images with descriptive keywords using AI. These keywords are stored in a managed metadata column, making it easier to search, sort, filter, and manage the images. + :::column-end::: + :::column span=""::: +  + :::column-end::: ++[Learn more about image tagging in Microsoft Syntex.](image-tagging-overview.md) + ### Optical character recognition :::row::: This feature is useful when you have a specific piece of information you want to  :::column-end::: :::column span="3":::- Understanding your content allows for better compliance control and increases management and governance options for all your data. When content is properly tagged and labeled, you have better control over your data and can follow regulations more easily. Syntex helps you ensure compliance by using retention labels and sensitivity labels to manage your documents. + Understanding your content allows for better compliance control and increases management and governance options for all your data. When content is properly tagged and labeled, you have better control over your data and can follow regulations more easily. Syntex helps you ensure compliance by using retention labels and sensitivity labels to manage your documents. :::column-end::: :::row-end::: |
| syntex | Syntex Pay As You Go Services | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/syntex/syntex-pay-as-you-go-services.md | When you use Microsoft Syntex [pay-as-you-go](syntex-azure-billing.md), services |Service|What's counted?|What's billed?| |:-|:--|:-|-|Prebuilt document processing|The number of pages processed for PDF or image files. Each of these counts as one transaction. You won't be charged for model training. You will be charged for processing whether or not there's a positive classification, or any entities extracted.<br><br>Processing occurs on document upload and on subsequent updates. Processing is counted for each model applied. For example, if you have two models applied to a library and you upload or update a five-page document in that library, the total pages processed is 10.|$0.01/transaction| -|Unstructured document processing|The number of pages processed for Word, PDF, or TIFF files; the number of sheets for Excel files; the number of slides for PowerPoint files; or the number of files for other file types. Each of these counts as one transaction. You won't be charged for model training. You will be charged for processing whether or not there's a positive classification, or any entities extracted.<br><br>Processing occurs on document upload and on subsequent updates. Processing is counted for each model applied. For example, if you have two models applied to a library and you upload or update a five-page document in that library, the total pages processed is 10.|$0.05/transaction| -|Optical character recognition |The number of pages processed for images (JPEG, JPG, PNG, or BMP); the number of pages processed for PDF, TIF, or TIFF; or the number of embedded images in Teams chats and email messages. Each of these counts as one transaction. Processing occurs every time the file is edited. |$0.001/transaction| -|Image tagging|The number of images processed. Each processed image counts as one transaction. You wonΓÇÖt be charged if you only enable pay-as-you-go billing for image tagging. You will be charged only when you enable image tagging on a document library.|$0.001/image| +|Prebuilt document processing|The number of pages processed for PDF or image files. Each of these counts as one transaction. You won't be charged for model training. You'll be charged for processing whether or not there's a positive classification, or any entities extracted.<br><br>Processing occurs on document upload and on subsequent updates. Processing is counted for each model applied. For example, if you have two models applied to a library and you upload or update a five-page document in that library, the total pages processed is 10.|$0.01/transaction| +|Unstructured document processing|The number of pages processed for Word, PDF, or TIFF files; the number of sheets for Excel files; the number of slides for PowerPoint files; or the number of files for other file types. Each of these counts as one transaction. You won't be charged for model training. You'll be charged for processing whether or not there's a positive classification, or any entities extracted.<br><br>Processing occurs on document upload and on subsequent updates. Processing is counted for each model applied. For example, if you have two models applied to a library and you upload or update a five-page document in that library, the total pages processed is 10.|$0.05/transaction| +|Image tagging |The number of images processed. Each processed image counts as one transaction. You wonΓÇÖt be charged if you only enable pay-as-you-go billing for image tagging. You'll be charged only when you [enable image tagging on a document library](image-tagging.md). |$0.001/image | +|Optical character recognition |The number of pages processed for images (JPEG, JPG, PNG, or BMP); the number of pages processed for PDF, TIF, or TIFF; or the number of embedded images in Teams chats and email messages. Each of these counts as one transaction. Processing occurs every time the file is edited. |$0.001/transaction| -## Related topics +## Related articles [Microsoft Syntex - SharePoint Advanced Management overview](/sharepoint/advanced-management) [Licensing for Microsoft Syntex](syntex-licensing.md)++[Configure pay-as-you-go billing](syntex-azure-billing.md) |